@remit/backend 0.0.16 → 0.0.18

package/dev-server/relational-health.test.ts

@@ -0,0 +1,91 @@
+import assert from "node:assert/strict";
+import { chmodSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, it } from "node:test";
+import Database from "better-sqlite3";
+import { checkRelationalStore } from "./relational-health.js";
+
+describe("checkRelationalStore", () => {
+	const ORIGINAL_DATA_BACKEND = process.env.DATA_BACKEND;
+	const ORIGINAL_SQLITE_DB_PATH = process.env.SQLITE_DB_PATH;
+	let dir: string | undefined;
+
+	afterEach(() => {
+		if (ORIGINAL_DATA_BACKEND === undefined) delete process.env.DATA_BACKEND;
+		else process.env.DATA_BACKEND = ORIGINAL_DATA_BACKEND;
+		if (ORIGINAL_SQLITE_DB_PATH === undefined) {
+			delete process.env.SQLITE_DB_PATH;
+		} else {
+			process.env.SQLITE_DB_PATH = ORIGINAL_SQLITE_DB_PATH;
+		}
+		if (dir) {
+			rmSync(dir, { recursive: true, force: true });
+			dir = undefined;
+		}
+	});
+
+	it("is true without touching disk on the AWS/DynamoDB path", async () => {
+		delete process.env.DATA_BACKEND;
+		delete process.env.SQLITE_DB_PATH;
+		assert.equal(await checkRelationalStore(), true);
+
+		process.env.DATA_BACKEND = "dynamodb";
+		assert.equal(await checkRelationalStore(), true);
+	});
+
+	it("is true when the SQLite file is reachable", async () => {
+		dir = mkdtempSync(join(tmpdir(), "remit-health-"));
+		const dbPath = join(dir, "remit.db");
+		new Database(dbPath).close();
+
+		process.env.DATA_BACKEND = "sqlite";
+		process.env.SQLITE_DB_PATH = dbPath;
+
+		assert.equal(await checkRelationalStore(), true);
+	});
+
+	it("is false when SQLITE_DB_PATH points at a directory that does not exist", async () => {
+		process.env.DATA_BACKEND = "sqlite";
+		process.env.SQLITE_DB_PATH = "/nonexistent/remit.db";
+
+		assert.equal(await checkRelationalStore(), false);
+	});
+
+	it("is false when the SQLite file exists but is unreadable", async () => {
+		dir = mkdtempSync(join(tmpdir(), "remit-health-"));
+		const dbPath = join(dir, "remit.db");
+		new Database(dbPath).close();
+		chmodSync(dbPath, 0o000);
+
+		process.env.DATA_BACKEND = "sqlite";
+		process.env.SQLITE_DB_PATH = dbPath;
+
+		assert.equal(await checkRelationalStore(), false);
+	});
+
+	it("is false when the file is readable but no longer writable", async () => {
+		dir = mkdtempSync(join(tmpdir(), "remit-health-"));
+		const dbPath = join(dir, "remit.db");
+		new Database(dbPath).close();
+
+		process.env.DATA_BACKEND = "sqlite";
+		process.env.SQLITE_DB_PATH = dbPath;
+		assert.equal(await checkRelationalStore(), true);
+
+		// Readable, not writable: the read-only SELECT ping still opens and
+		// succeeds, so without `access(W_OK)` this reports healthy on a store the
+		// backend can no longer write to. This is the case the writability check
+		// exists to catch — dropping `access()` from pingSqlite fails this test.
+		chmodSync(dbPath, 0o400);
+		assert.equal(await checkRelationalStore(), false);
+	});
+
+	it("is false when Postgres connection fails", async () => {
+		process.env.DATA_BACKEND = "postgres";
+		process.env.PG_CONNECTION_URL =
+			"postgresql://remit:remit@127.0.0.1:1/nonexistent";
+
+		assert.equal(await checkRelationalStore(), false);
+	});
+});

package/dev-server/relational-health.ts

@@ -0,0 +1,57 @@
+import { access, constants } from "node:fs/promises";
+import { isSelfHostSqlBackend } from "../src/data-backend.js";
+
+// The SELECT ping opens a read-only connection, so it keeps succeeding on a
+// file that can still be read but no longer written — permissions revoked to
+// read-only, or the volume remounted read-only under the process. The backend
+// must write (better-auth persists sessions to this same file, RFC 036 D3), so
+// a readable-but-unwritable store has to report unhealthy. `access(R_OK|W_OK)`
+// checks both bits in one fresh syscall; the read-only query never covers
+// writability. The query after it still exercises the SQL engine itself.
+const pingSqlite = async (): Promise<void> => {
+	const path = process.env.SQLITE_DB_PATH ?? "";
+	await access(path, constants.R_OK | constants.W_OK);
+
+	const { default: Database } = await import("better-sqlite3");
+	const db = new Database(path, { readonly: true });
+	try {
+		db.prepare("SELECT 1").get();
+	} finally {
+		db.close();
+	}
+};
+
+const pingPostgres = async (): Promise<void> => {
+	const { Client } = await import("pg");
+	const client = new Client({
+		connectionString: process.env.PG_CONNECTION_URL,
+		connectionTimeoutMillis: 3000,
+	});
+	await client.connect();
+	try {
+		await client.query("SELECT 1");
+	} finally {
+		await client.end();
+	}
+};
+
+/**
+ * A trivial read against whichever relational store DATA_BACKEND selects — the
+ * dependency `/health` must actually exercise (RFC 037 D5, R9) so a backend that
+ * booted with an unusable database reports unhealthy instead of a bare 200. The
+ * AWS/DynamoDB path has no relational store and is never checked.
+ */
+export const checkRelationalStore = async (): Promise<boolean> => {
+	if (!isSelfHostSqlBackend()) return true;
+
+	try {
+		if (process.env.DATA_BACKEND === "sqlite") {
+			await pingSqlite();
+		} else {
+			await pingPostgres();
+		}
+		return true;
+	} catch {
+		return false;
+	}
+};

package/dev-server/server.ts

@@ -16,6 +16,7 @@ import { serveContent } from "./content-handler.js";
 import { resolveContentPath } from "./content-path.js";
 import { parseAllowedOrigins, resolveAllowOrigin } from "./cors.js";
 import { createLambdaContext, createLambdaEvent } from "./lambda-helpers.js";
+import { checkRelationalStore } from "./relational-health.js";
 
 const app = express();
 
@@ -123,7 +124,12 @@ app.use((req: Request, res: Response, next: NextFunction) => {
 
 app.get("/.well-known/appspecific/com.chrome.devtools.json", () => ({}));
 
-app.get("/health", (_req: Request, res: Response) => {
+app.get("/health", async (_req: Request, res: Response) => {
+	const relationalStoreReachable = await checkRelationalStore();
+	if (!relationalStoreReachable) {
+		res.status(503).json({ status: "unhealthy" });
+		return;
+	}
 	res.json({
 		status: "ok",
 		timestamp: new Date().toISOString(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",
@@ -70,11 +70,15 @@
     "@remit/sqs-client": "*",
     "@aws-sdk/client-secrets-manager": "*",
     "@aws-sdk/client-sqs": "*",
+    "better-sqlite3": "^12.11.1",
     "drizzle-orm": "^0.45.2",
     "expect-env": "*",
     "openapi-backend": "*",
     "p-map": "*",
-    "@types/aws-lambda": "*"
+    "pg": "^8.0.0",
+    "@types/aws-lambda": "*",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/pg": "^8.0.0"
   },
   "publishConfig": {
     "access": "public"

package/src/handlers/thread.ts

@@ -270,11 +270,12 @@ export const buildListThreadMessagesOptions = (query: {
  * A ThreadMessage row is keyed by (threadId, messageId), and a messageId is
  * derived from the account plus the RFC 5322 Message-ID, so the same mail
  * synced from two folders is one row — the mailbox a thread spans is not what
- * duplicates it. `MessageMoveService.copyMessage` is the exception: it mints a
- * random id for the copy, so a copied message becomes a second row in the same
- * thread carrying the same `messageIdHeader`. Reading the whole thread rather
- * than one mailbox of it (#46) is what makes both rows visible at once, and two
- * entries for one message is never what a conversation should show.
+ * duplicates it. `MessageMoveService.copyMessage` is the exception: a copy is a
+ * per-folder placement with its own derived id (`deriveCopyMessageId`), so a
+ * copied message is a second row in the same thread carrying the same
+ * `messageIdHeader`. Reading the whole thread rather than one mailbox of it
+ * (#46) is what makes both rows visible at once, and two entries for one message
+ * is never what a conversation should show.
  *
  * The oldest row wins, so the original outlives the copy, with `threadMessageId`
  * breaking ties. Both are independent of sort order, so `asc` and `desc` keep